Audit Execution and Evidence Gathering
Domain 4 tests evidence discipline: what counts as objective evidence, how much is enough, and how to convert it into a defensible finding.
Core rules
- Evidence comes from interviews, observation, document and record review, and sampling; all of it must be verifiable and traceable.
- Use the say-do-check chain: what the procedure requires (say), what actually happens (do), what the criterion requires (check).
- Write nonconformities in three parts: the requirement, the evidence with identifiers and dates, and the gap.
- Major versus minor is a judgement about system failure or repeatability, not about the auditor's level of irritation.
- Open questions (“walk me through the transfer”) reveal the process; leading questions manufacture the answer you wanted.
- The auditor verifies and reports. Recommending a specific fix turns the audit into consultancy.
Worked example
An operator states that boiler feedwater pH is checked daily. The auditor asks to see the log: 28 entries in 30 days, with two gaps. The procedure requires daily checks and the permit requires daily monitoring. The finding is a nonconformity against 8.1 and the monitoring requirement, evidenced by the log identifier, the two missing dates, and the procedure clause. Two gaps in thirty is a control weakness, not proof that the boiler ran unmonitored for those days - word the report accordingly.
Traps that cost marks
- Recording a verbal assurance as evidence without a document or observation.
- Raising a nonconformity without naming the criterion it breaches.
- Writing opinions (“poor safety culture”) instead of observed facts.
- Closing a finding on a corrective-action plan rather than on the implemented action.